US20040122946A1 - Delegation of administrative operations in user enrollment tasks - Google Patents
Delegation of administrative operations in user enrollment tasks Download PDFInfo
- Publication number
- US20040122946A1 US20040122946A1 US10/327,329 US32732902A US2004122946A1 US 20040122946 A1 US20040122946 A1 US 20040122946A1 US 32732902 A US32732902 A US 32732902A US 2004122946 A1 US2004122946 A1 US 2004122946A1
- Authority
- US
- United States
- Prior art keywords
- domain
- administrator
- management system
- content management
- user
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Granted
Links
- 238000000034 method Methods 0.000 claims abstract description 42
- 230000004044 response Effects 0.000 claims description 5
- 238000007726 management method Methods 0.000 description 74
- 230000008569 process Effects 0.000 description 16
- 230000008901 benefit Effects 0.000 description 4
- 230000008859 change Effects 0.000 description 4
- 238000010586 diagram Methods 0.000 description 2
- 238000004519 manufacturing process Methods 0.000 description 2
- 238000012986 modification Methods 0.000 description 2
- 230000004048 modification Effects 0.000 description 2
- 230000004043 responsiveness Effects 0.000 description 2
- 238000000638 solvent extraction Methods 0.000 description 2
- 238000012790 confirmation Methods 0.000 description 1
- 238000001914 filtration Methods 0.000 description 1
- 230000006870 function Effects 0.000 description 1
- 238000009434 installation Methods 0.000 description 1
- 238000012545 processing Methods 0.000 description 1
- 238000001228 spectrum Methods 0.000 description 1
- 238000013519 translation Methods 0.000 description 1
Images
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/10—Protecting distributed programs or content, e.g. vending or licensing of copyrighted material ; Digital rights management [DRM]
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/60—Protecting data
- G06F21/62—Protecting access to data via a platform, e.g. using keys or access control rules
- G06F21/6218—Protecting access to data via a platform, e.g. using keys or access control rules to a system of files or objects, e.g. local or distributed file system or database
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L67/00—Network arrangements or protocols for supporting network services or applications
- H04L67/50—Network services
- H04L67/56—Provisioning of proxy services
- H04L67/568—Storing data temporarily at an intermediate stage, e.g. caching
- H04L67/5682—Policies or rules for updating, deleting or replacing the stored data
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
- H04L9/40—Network security protocols
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L69/00—Network arrangements, protocols or services independent of the application payload and not provided for in the other groups of this subclass
- H04L69/30—Definitions, standards or architectural aspects of layered protocol stacks
- H04L69/32—Architecture of open systems interconnection [OSI] 7-layer type protocol stacks, e.g. the interfaces between the data link level and the physical level
- H04L69/322—Intralayer communication protocols among peer entities or protocol data unit [PDU] definitions
- H04L69/329—Intralayer communication protocols among peer entities or protocol data unit [PDU] definitions in the application layer [OSI layer 7]
-
- Y—GENERAL TAGGING OF NEW TECHNOLOGICAL DEVELOPMENTS; GENERAL TAGGING OF CROSS-SECTIONAL TECHNOLOGIES SPANNING OVER SEVERAL SECTIONS OF THE IPC; TECHNICAL SUBJECTS COVERED BY FORMER USPC CROSS-REFERENCE ART COLLECTIONS [XRACs] AND DIGESTS
- Y10—TECHNICAL SUBJECTS COVERED BY FORMER USPC
- Y10S—TECHNICAL SUBJECTS COVERED BY FORMER USPC CROSS-REFERENCE ART COLLECTIONS [XRACs] AND DIGESTS
- Y10S707/00—Data processing: database and file management or data structures
- Y10S707/99931—Database or file accessing
- Y10S707/99939—Privileged access
Definitions
- the invention relates to information storage and retrieval computer systems. More particularly, it relates to methods, devices, and articles of manufacture for delegating administrative operations in a content management system shared among different organizations.
- a content management system is a computer-based infrastructure for managing the full spectrum of digital information. Large collections of scanned images, facsimiles, electronic office documents, XML and HTML files, computer output, audio, video, multimedia, and virtual reality content can be stored and accessed through the content management system.
- the content management system integrates content with line of business, customer service, enterprise resource planning (ERP), digital asset management, distance learning, World-Wide Web (“Web”) content management or other applications to accelerate benefits across the enterprise.
- ERP enterprise resource planning
- Web World-Wide Web
- One instance of such a content manager system can be visualized as a triangle, its three vertices being the client, a library server and an object server (resource manager).
- the client provides the user's interface which gives the user the capability of storing, searching for, and, marking-up documents or other objects.
- the library server is the equivalent of a card catalog which holds information about the objects, including their location.
- the object server (OS), also referred to herein as the resource manager (RM) is where either the actual object or a pointer to the actual object is stored.
- the core library server logic (except for system utilities and housekeeping tasks) is packaged as a set of relational data base (RDB) stored procedures (SPs) containing embedded SQL statements. Each stored procedure is precompiled and runs on a relational database (RDB) server.
- RDB relational data base
- each library server process is a relational database server process.
- the interface to a library server is SQL, through which either stored procedures can be called or SQL SELECT statements (including cursor support) can be executed. Remote access to the library server is via a relational database client.
- the resource managers can support different/multiple access protocols.
- the resource manager or object server, supports the HTTP protocol.
- the basic information entities managed by the library server are “items.” “Items” as used herein come in two types, simple items and resource items. Resource items can have content associated with them that is stored in one or more resource managers. Resource items point to their content via Resource uniform resource locator (URL) related data.
- URL Resource uniform resource locator
- the library server and resource manager, or object server are separate processes, often running on different machines.
- clients first contact the library server to create/update an index for an object, and to determine where the object is to be stored/replaced.
- the client then sends a request to the resource manager to store/replace the object.
- This person has authority to add, update, and delete records for any user of the content management system, including specification of privileges, access rights, and membership in groups. While it is be possible to delegate these tasks to a departmental administrator, it is also necessary to simply trust that this person will not intentionally or accidentally cross the boundary between that department for which that administrator is responsible and other departments. In addition to security concerns, the productivity of administrators is impacted by the quantity of information that is presented to a central administrator.
- index types types of documents
- work baskets processing steps
- the content management system stores over 600 types of documents or index types (200 customers ⁇ 3 document types per customer), with over 1,400 work baskets (200 customers ⁇ 7 workbaskets per customer), and supporting a total of 8,000 users (200 customers ⁇ 40 users per customer).
- workbaskets workbaskets
- locating the proper resource to which a new user should be authorized can be tedious and occasionally can result in errors.
- the large lists for defining the index types, workbaskets and users impact both system performance (the time to retrieve the list) and user performance (time to find an entry in the list).
- An embodiment of the invention relates to a method of controlling access in a content management system.
- the method includes defining a domain among a plurality of domains for the content management system and designating a domain administrator for the domain. This enables the domain administrator to perform administrative tasks within the domain without revealing or affecting information in other domains of the content management system. For example, a domain administrator can view user information only for users associated with that domain. The domain administrator also can associate a user with only the defined domain, thereby limiting the user's access to information in the system to information associated with the domain.
- FIG. 1 is a block diagram of a content management system.
- FIG. 2 is a diagram illustrating the concept of administrative domains within a content management system.
- FIGS. 3 A- 3 D are database tables within a content management system that supports administrative domains.
- FIG. 4 is a flowchart illustrating a process for defining an administrative domain in a content management system.
- FIG. 5 is a flowchart illustrating a process for adding new users to an administrative domain in a content management system.
- FIG. 6 is a flowchart illustrating a process for listing users associated with an administrative domain in a content management system.
- FIG. 7 is a flowchart illustrating a process for updating user ID information in an administrative domain in a content management system.
- a domain can be specified with a numeric identifier together with a name and description to be used to logically relate or isolate information.
- 200 domains would be defined, one for each client. Administrators for each domain are defined who are able to manage user enrollment for the domain. By filtering resources by domain, these domain administrators will not see or be able to authorize a user to access a resource in another domain.
- the content management system 10 shown in FIG. 1 illustrates one or more clients 12 , a library server 14 , and one or more resource managers 16 , and how they interact to store an item.
- the library server includes library server stored procedures 14 a , a library server database 14 b , and a library server tracking table 14 c .
- the resource manager includes an HTTP server 16 a , a content management resource manager “Store Object” agent 16 b , a resource manager tracking table data base 16 c , and a file system 16 d.
- a given object is defined by an entry in an index or list of objects with a unique identifier that is coupled with searchable attributes including a file or resource manager identifier and a collection identifier.
- the collection identifier describes how the object is to be managed for storage.
- a collection is a unit of storage: conceptually a cabinet where objects are placed. It may include many volumes of various storage media and a set of rules as to how the actual objects are stored and handled.
- the library server 14 and each of the plurality of resource managers 16 are used in the content management system 10 to manage digital content.
- the library server 14 holds index, attribute and content information in a searchable form within the library catalog 16 , which is a relational database.
- the library server 14 contains a foldering system and references to data objects that may be stored in a resource manager or in other external file systems.
- the data objects may be any type of digital information, such as multimedia data.
- the library server 14 also typically contains a workflow system.
- the library server 14 includes a plurality of tables that are stored in the library catalog 16 .
- the tables include content and administrative information.
- a resource manager table maintains information concerning the plurality of resource managers.
- a collection name table holds the names of each collection for each resource manager.
- a user table holds information concerning each user of the content management system.
- the resource managers 16 each have a file system 16 d that holds objects as files or references to other storage systems.
- the resource manager provides for name translation from library server name to file system name/location and for hierarchical storage management and transport of objects.
- Each of the resource managers 16 also stores meta information that can be held in the file system or in transaction log files.
- Each resource manager includes an object server table in which a row exists for each object stored and managed by the resource manager. The row identifies the object and maps its identifier to a local filename.
- the client begins a transaction and returns confirmation to the end user.
- the client establishes a connection to the library server, and sends requests 18 to the library server to create a catalog entry (as an index entry) for a content management object.
- the client receives information 19 back from the library server as to where to store the object.
- the library server returns to the client a URL for the resource manager where the object is to be stored, an object token, and other information.
- the client then sends a request 20 , such as an HTTP request, to the resource manager to store the object.
- the client receives a response 21 from the resource manager with object metadata.
- This metadata includes, by way of exemplification, the object name, size, and creation timestamp.
- the client sends a message 22 with this metadata to the library server.
- the library server sends a reply 23 to the client indicating success or failure of the of the metadata update, at which point the client commits the library server updates.
- the client After committing the library server updates, the client sends a request 24 to the resource manager to delete its tracking table record.
- the client receives a reply 25 from the resource manager indicating success or failure in deleting the tracking table entry.
- a domain is a section of a library server that one or more administrators manage. Domains relate to user IDs, user groups, privilege sets, access control lists, resource managers, and collections of items. Domains are not visible to users, but rather are used to simplify and enhance administrative tasks in operating a content management system. Domains are named for the convenience of system administrators. Those names are not known by users but only have meaning to the system administrators who manage them.
- Domains limit administrative and user access to only a subsection of the library server.
- An administrator with full privileges to the library server can delegate limited administrative privileges to another administrator.
- the administrator with full privileges referred to as a super administrator, has access to all sections of a library server while an administrator with limited privileges, a subadministrator, has access to only a section of the library server.
- Use of domains is transparent to users because they do not know that their access has been limited to only a part of the library server. Accordingly, users are aware only of items within that portion, or domain of the content management system to which those users are associated.
- FIG. 2 is a conceptual illustration of the relationship of various domains in a content management system.
- the entire content management system is managed by a super administrator who has total privileges for and access to the entire system.
- the entire content management system can be considered a super domain 26 corresponding to the universe of privileges and access controls.
- the super domain 26 corresponding to the universal set and encompassing the entire content management system, is managed by the super administrator.
- the content management system can be partitioned into domains 28 , 30 and 32 , each of which is named (e.g., Domain 1, Domain 2, Domain-n) and is managed by a subadministrator, also referred to as a domain administrator.
- a default domain 34 called Public is a shared domain that is accessible by all administrators and users regardless of the domain to which they are assigned. Partitioning the content management system into domains enables domain administrators to administer only a portion of the content management system while preventing their access to other portions.
- Each type of administrator has the ability to create, retrieve, update, and delete the objects in their domains, including users and collections. Domain administrators can view and retrieve objects only in their domain but also can list and retrieve objects in a public, or shared domain.
- Super administrators have access to all domains on the library server. They can create an object and assign it to a domain. Some objects, such as privilege sets and access control lists (ACL's), only may be created by a super administrator for a domain administrator to use.
- ACL's privilege sets and access control lists
- FIG. 3A shows an example of an administration domain table 40 .
- the table includes a domain ID column 42 that holds identifiers of the various domains defined within the content management system.
- a domain name column 44 provides a descriptive name of the domain.
- An ACL set codes column 46 and a privilege set codes column 48 relate the ACL set codes and privilege set codes applicable for a domain with its domain ID.
- domain D 1 refers to the super domain. That domain is associated with the ACL set code of “AS 1 ” and privilege set code “PS 1 .”
- Those set codes define sets of access control lists and sets of privileges that are associated with the super administrator.
- Subdomains such as domains D 3 and D 4 are domains established for separate organizations, such as different companies using the same content management system.
- “Company X” is assigned to domain D 3 .
- Company X's access is defined by access control lists associated with access control list set codes, AS 27 and AS 29 .
- the privileges for Company X are defined by privilege set codes PS 92 and PS 93 .
- Those access control list set codes and privilege set codes refer to ACL sets and privilege sets that define the access rights and the privileges that are granted to Company X. Accordingly, the domain D 3 is limited by those access control lists and privileges.
- the administration domain table 40 also includes a public domain D 2 that is a shared domain that is accessible by all users of the system.
- a default domain D 1000 is used as the default domain when establishing a user.
- the system administrator whether it be a super administrator or a domain administrator, can change the default domain to a domain with which the administrator is authorized to access.
- a user table in a content management system 50 is shown in FIG. 3B and includes columns for User ID 52 , User Privilege Set Code 56 , Default ACL Set Code 58 , Default Resource Manager 60 , Default Collection Code 62 , Password 64 , User Name 66 , and a column for Other Indicators 68 .
- a domain ID column 54 is added to the user table 50 to support the use of domains.
- the User ID column 52 specifies a unique user ID for each user of the content management system.
- a Domain ID 54 is associated with each user.
- the user also is associated with certain privileges defined by privilege set codes, and other information pertinent to the user such as a default ACL set for the user, the default resource manager to which objects stored by the user are placed, and a default collection code for the user's objects.
- the table also specifies a user name (i.e., X_Admin) and a password (i.e., ZYX).
- X_JSmith and X_Admin are defined within the same domain D 3
- user Y_Admin and Y_SJones are defined as being in domain D 4 .
- domain D 3 is designated for Company X
- domain D 4 is designated for Company Y.
- a resource manager is defined by a resource manager code plus other information that defines characteristics of the resource manager and the method of accessing that resource manager over a network, plus a domain ID to restrict visibility to the RM definition.
- a resource manager (RM) table 70 is shown in FIG. 3C. This table relates information about resource managers with other information needed by the content management system. This table includes an RM Code 72 , an RM Name 74 (i.e., X_RM — 1), a Domain ID 76 , a Network Address 80 indicating an address on a network for the resource manager, and other indicators 80 with information needed by the system. A Domain ID 76 is added to the RM table 70 to associate the resource managers with domains. In the example shown in FIG.
- domain D 3 is associated with two resource managers, namely resource manager X_RM — 1 and X_RM — 2.
- Domain D 4 is associated with another resource manager, Y_RM — 3.
- objects for Company X are stored in resource managers R 1 and R 2 and objects for Company Y are stored in resource manager R 3 .
- Table 3 D illustrates a collection name table for using system-managed storage (SMS) collections in the content management system.
- SMS system-managed storage
- This table includes an SMS Collection Code 92 , an SMS Collection Name 94 , and an RM Code 96 where the collection resides.
- the table also includes Other Indicators 100 that may be used by the content management system.
- a Domain ID 98 is added to the collection name table to associate collections with domains.
- the collection name table associates a particular SMS collection with both a resource manager and a domain. For example, a collection “X-Collection- 1 ,” which is resident on the resource manager having RM code R 1 , is associated with domain D 3 , and is given an SMS collection code of S 1 .
- the domain D 3 can include a second collection, in this case it is named “X-Collection — 2,” having an SMS collection code of S 2 .
- the domains are used to help a system administrator administer subsets of a content management system. Some of the administrative operations that can be performed as a result of using domains are described below.
- FIG. 4 is a flowchart illustrating a process of defining a domain.
- a super administrator who has the privileges suitable to define a domain within the content management system, initiates defining a new domain in operation 102 .
- the super administrator in operation 104 , can associate a privilege set with the domain and can create or modify a definition of an ACL set to be associated with the new domain.
- the super administrator also specifies resource managers and collections for the domain in operation 106 .
- the super administrator assigns previously defined users of the content management system to the domain.
- the system administrator can also add a new user.
- the super administrator specifies a privilege set authorized for the domain for that new user in operation 112 , and the process ends in operation 1114 . If no new user is to be added after operation 108 the process ends in operation 114 .
- a domain administrator creates a user ID
- the administrator has the choice of assigning it to a domain, or letting it remain with a default domain (e.g., Domain D 1000 ) automatically designated at the time the user ID is created.
- a domain administrator can change the domain associated with the user ID at a later time by changing the user properties specified in the user table.
- a user ID can have access to only one domain at a time and would not be added to the public, or shared domain.
- a process typically performed by a domain administrator is to add a new user to the domain administered by the domain administrator or to a public domain.
- FIG. 5 is a flowchart illustrating such a process.
- a domain administrator in operation 120 , such as a domain administrator for Company X, can add a new user to the domain for Company X, i.e., domain D 3 , or to a public domain.
- the new user is added without affecting other domains in the content management system, since the new user automatically is associated with the domain administrator's domain or to the public domain designated by the domain administrator.
- this new user can be added by the domain administrator for Company X without involvement by the super administrator responsible for administering the entire content management system.
- Any user ID added to a domain must also have an associated privilege set.
- the privilege sets can be placed in the public, or shared, domain to make them available to any user.
- the Company X domain administrator specifies a privilege set for the new user.
- the content management system determines whether the domain associated with the specified privilege set is equal to the domain administrator's domain or a public domain. If not, the system prevents those privileges from being associated with the user and the user definition fails in operation 126 . If the privilege set is associated with the appropriate domain, then operation 128 is performed in which the domain administrator specifies a default resource manager for the user.
- User access can be restricted to one or more resource managers by assigning the user to a specific domain associated with those resource managers.
- a new resource manager When a new resource manager is defined for a library server to access, it can be associated with a domain, such that users who also are associated with that domain can use that resource manager. The default for all resource managers is public. If all users are not to have access to the resource manager, it must be assigned to a domain.
- the system checks whether the domain associated with the specified resource manager equals the domain administrator's domain or is in a public domain. If not, the user definition fails 126 , but if the domains are equal or if the resource manager is defined in a public domain, operation continues.
- User access can be restricted to one or more collections on a resource manager by assigning those collections to a specific domain. Even if the resource manager for the collection is in the public domain, that collection still can be assigned to some other non-shared domain. If the resource manager, however, is defined to a specific domain already, then the collection cannot be assigned to any domain other than the one to which the resource manager is associated.
- the Company X domain administrator specifies a default collection for the user.
- operation 134 it is determined if the domain associated with the specified collection is the same as the domain administrator's domain or is a public domain. If not, then the user definition failure occurs as indicated in operation 126 . Otherwise, the user definition ends in operation 136 , and the new user is defined for the Company X domain.
- an administrator can request a list of all users, in operation 150 .
- This function can either list all registered users, regardless of whether they are logged onto the system, or list only the users who are logged on. In either case, the users can be listed by domain.
- the administrator in operation 150 , can query the content management system for one or more specific users. In generating either the list or performing the query, the system, in operation 152 , checks whether the administrator making the request is a super administrator. If so, then in operation 154 all of the users that are defined to the content management system are listed for the super administrator's use in performing an administrative task.
- the administrator is not a super administrator
- the content management system lists only the users defined to the system and/or logged on to the system, who are members of the same domain as the administrator making the request. In this manner, a domain administrator can view only users within the administrator's domain. Accordingly, an administrator for Company X can only view the Company X users of the content management system.
- the domain administrator for Company X does not have visibility into the users of any other domain such as Company Y's domain, even though Company Y's content is hosted on the same content management system.
- FIG. 7 Another administrative task that can be performed is updating user information. This is illustrated in FIG. 7.
- an administrator requests an update to user information in the content management system.
- operation 172 a determination is made whether the user's domain is the same as the requesting domain administrator's domain. If so, the update is allowed in operation 174 . However, if the domains are not equal, the process flows to operation 176 where it is determined whether the administrator is a super administrator. If so, the update operation is allowed in operation 174 . However, if the administrator is not a super administrator, then the request is refused in operation 178 . In this way a user in one domain cannot update the user information of the user in another domain.
- the Company X domain administrator cannot change user information for a user who is a member of the Company Y domain, even though Company Y and Company X share the same content management system. Accordingly, various organizations' information hosted on the same content manager server are separated and kept private.
- a super administrator can create a user group by grouping together multiple user IDs into a logical group.
- a group is associated with a domain either a private domain or a public domain.
- a domain administrator can view users only if the group's domain ID matches the domain administrator's domain ID or is an ID for a public domain.
- a domain administrator can add a user to a group only if the user's domain ID matches the group's domain ID or corresponds to a public domain.
- a domain administrator can query a group having the same domain ID as the domain administrator, or a group designated as a public group.
- the system can be configured so that only the users with a domain ID matching the domain administrator's domain ID or are associated with a public domain are listed in response to the query.
Abstract
A system and method of controlling access in a content management system includes defining a domain among a plurality of domains for the content management system and designating a domain administrator for the domain. This enables the domain administrator to perform administrative tasks within the domain without revealing or affecting information in other domains of the content management system. For example, a domain administrator can view user information only for users associated with that domain. The domain administrator also can associate a user with only the defined domain, thereby limiting the user's access to information in the system to information associated with the domain
Description
- 1. Field of the Invention
- The invention relates to information storage and retrieval computer systems. More particularly, it relates to methods, devices, and articles of manufacture for delegating administrative operations in a content management system shared among different organizations.
- 2. Description of the Related Art
- A content management system is a computer-based infrastructure for managing the full spectrum of digital information. Large collections of scanned images, facsimiles, electronic office documents, XML and HTML files, computer output, audio, video, multimedia, and virtual reality content can be stored and accessed through the content management system. The content management system integrates content with line of business, customer service, enterprise resource planning (ERP), digital asset management, distance learning, World-Wide Web (“Web”) content management or other applications to accelerate benefits across the enterprise.
- One instance of such a content manager system can be visualized as a triangle, its three vertices being the client, a library server and an object server (resource manager). The client provides the user's interface which gives the user the capability of storing, searching for, and, marking-up documents or other objects. The library server is the equivalent of a card catalog which holds information about the objects, including their location. The object server (OS), also referred to herein as the resource manager (RM) is where either the actual object or a pointer to the actual object is stored.
- The core library server logic (except for system utilities and housekeeping tasks) is packaged as a set of relational data base (RDB) stored procedures (SPs) containing embedded SQL statements. Each stored procedure is precompiled and runs on a relational database (RDB) server. Thus, each library server process is a relational database server process. The interface to a library server is SQL, through which either stored procedures can be called or SQL SELECT statements (including cursor support) can be executed. Remote access to the library server is via a relational database client.
- The resource managers (RMs) can support different/multiple access protocols. For example, the resource manager, or object server, supports the HTTP protocol. The basic information entities managed by the library server are “items.” “Items” as used herein come in two types, simple items and resource items. Resource items can have content associated with them that is stored in one or more resource managers. Resource items point to their content via Resource uniform resource locator (URL) related data.
- The library server and resource manager, or object server, are separate processes, often running on different machines. In operation, clients first contact the library server to create/update an index for an object, and to determine where the object is to be stored/replaced. The client then sends a request to the resource manager to store/replace the object.
- Administrators of content management systems, as well as other complex computing systems, face a common problem: adding users, changing access rights, or any other administrative operation must be performed by a central administrator. This person has authority to add, update, and delete records for any user of the content management system, including specification of privileges, access rights, and membership in groups. While it is be possible to delegate these tasks to a departmental administrator, it is also necessary to simply trust that this person will not intentionally or accidentally cross the boundary between that department for which that administrator is responsible and other departments. In addition to security concerns, the productivity of administrators is impacted by the quantity of information that is presented to a central administrator.
- These problems are compounded when a service provider operates a content management system that services more than one customer such that the
content management system 10, shown in FIG. 1, hosts the content of more than one customer. - To help understand the significance of this problem, consider the scenario in which a service provider offers a content management solution to over 200 independent customers. In that scenario each customer supports40 users that use three types of documents (“index types”) that are stored in the content management system, each of which is processed by seven processing steps (“work baskets”). Accordingly, the content management system stores over 600 types of documents or index types (200 customers×3 document types per customer), with over 1,400 work baskets (200 customers×7 workbaskets per customer), and supporting a total of 8,000 users (200 customers×40 users per customer). Because of the large number of customers, document types, workbaskets, and users, locating the proper resource to which a new user should be authorized can be tedious and occasionally can result in errors. The large lists for defining the index types, workbaskets and users impact both system performance (the time to retrieve the list) and user performance (time to find an entry in the list).
- Although the problem is most serious with large installations, customer feedback has shown that this is a concern whenever there is more than one department using the content management system. Accordingly, there is a need to handle administration of content management systems in a more efficient manner that is less burdensome to administrators and in a manner that reduces administrative errors and respects organizational boundaries.
- An embodiment of the invention relates to a method of controlling access in a content management system. The method includes defining a domain among a plurality of domains for the content management system and designating a domain administrator for the domain. This enables the domain administrator to perform administrative tasks within the domain without revealing or affecting information in other domains of the content management system. For example, a domain administrator can view user information only for users associated with that domain. The domain administrator also can associate a user with only the defined domain, thereby limiting the user's access to information in the system to information associated with the domain.
- Features and advantages of the invention will become apparent upon consideration of the following descriptions and descriptive figures of specific embodiments thereof. While these descriptions go into specific details of the invention, it should be understood that variations may and do exist and would be apparent to those skilled in the art based on the descriptions herein.
- FIG. 1 is a block diagram of a content management system.
- FIG. 2 is a diagram illustrating the concept of administrative domains within a content management system.
- FIGS.3A-3D are database tables within a content management system that supports administrative domains.
- FIG. 4 is a flowchart illustrating a process for defining an administrative domain in a content management system.
- FIG. 5 is a flowchart illustrating a process for adding new users to an administrative domain in a content management system.
- FIG. 6 is a flowchart illustrating a process for listing users associated with an administrative domain in a content management system.
- FIG. 7 is a flowchart illustrating a process for updating user ID information in an administrative domain in a content management system.
- The embodiments described below are described with reference to the above drawings, in which like reference numerals designate like components.
- To reduce the burden on system administrators and gain the benefit of improved productivity, responsiveness to users requests, accuracy and avoid possible security exposures, the content management system described here introduces the concept of administrative domains. A domain can be specified with a numeric identifier together with a name and description to be used to logically relate or isolate information. In the customer scenario described above, 200 domains would be defined, one for each client. Administrators for each domain are defined who are able to manage user enrollment for the domain. By filtering resources by domain, these domain administrators will not see or be able to authorize a user to access a resource in another domain.
- The problems with conventional content management systems can be overcome by partitioning administrative aspects of the system into domains. However, prior to describing domains it is helpful to understand the operation of the content management system shown in FIG. 1. Although the content management system shown in FIG. 1 is a client-server system, use of administrative can be used in systems that do not use a client-server architecture.
- The
content management system 10 shown in FIG. 1 illustrates one ormore clients 12, alibrary server 14, and one ormore resource managers 16, and how they interact to store an item. The library server includes library server storedprocedures 14 a, alibrary server database 14 b, and a library server tracking table 14 c. The resource manager includes anHTTP server 16 a, a content management resource manager “Store Object”agent 16 b, a resource manager trackingtable data base 16 c, and afile system 16 d. - A given object is defined by an entry in an index or list of objects with a unique identifier that is coupled with searchable attributes including a file or resource manager identifier and a collection identifier. The collection identifier describes how the object is to be managed for storage. A collection is a unit of storage: conceptually a cabinet where objects are placed. It may include many volumes of various storage media and a set of rules as to how the actual objects are stored and handled. The
library server 14 and each of the plurality ofresource managers 16 are used in thecontent management system 10 to manage digital content. - The
library server 14 holds index, attribute and content information in a searchable form within thelibrary catalog 16, which is a relational database. Generally thelibrary server 14 contains a foldering system and references to data objects that may be stored in a resource manager or in other external file systems. The data objects may be any type of digital information, such as multimedia data. Thelibrary server 14 also typically contains a workflow system. - The
library server 14 includes a plurality of tables that are stored in thelibrary catalog 16. The tables include content and administrative information. A resource manager table maintains information concerning the plurality of resource managers. A collection name table holds the names of each collection for each resource manager. A user table holds information concerning each user of the content management system. - The
resource managers 16 each have afile system 16 d that holds objects as files or references to other storage systems. The resource manager provides for name translation from library server name to file system name/location and for hierarchical storage management and transport of objects. Each of theresource managers 16 also stores meta information that can be held in the file system or in transaction log files. Each resource manager includes an object server table in which a row exists for each object stored and managed by the resource manager. The row identifies the object and maps its identifier to a local filename. - At a high level, the client begins a transaction and returns confirmation to the end user. Next, the client establishes a connection to the library server, and sends requests18 to the library server to create a catalog entry (as an index entry) for a content management object. In response, the client receives information 19 back from the library server as to where to store the object. For example, the library server returns to the client a URL for the resource manager where the object is to be stored, an object token, and other information. The client then sends a request 20, such as an HTTP request, to the resource manager to store the object. The client receives a response 21 from the resource manager with object metadata. This metadata includes, by way of exemplification, the object name, size, and creation timestamp. The client sends a message 22 with this metadata to the library server. The library server sends a reply 23 to the client indicating success or failure of the of the metadata update, at which point the client commits the library server updates. After committing the library server updates, the client sends a request 24 to the resource manager to delete its tracking table record. The client receives a reply 25 from the resource manager indicating success or failure in deleting the tracking table entry.
- A similar process is followed when the client requests an object stored in the content management system.
- To reduce the burden on system administrators and gain the benefit of improved productivity, responsiveness to users requests, accuracy and avoid possible security exposures, a new content management system is described here that introduces the concept of administrative domains.
- A domain is a section of a library server that one or more administrators manage. Domains relate to user IDs, user groups, privilege sets, access control lists, resource managers, and collections of items. Domains are not visible to users, but rather are used to simplify and enhance administrative tasks in operating a content management system. Domains are named for the convenience of system administrators. Those names are not known by users but only have meaning to the system administrators who manage them.
- Domains limit administrative and user access to only a subsection of the library server. An administrator with full privileges to the library server can delegate limited administrative privileges to another administrator. The administrator with full privileges, referred to as a super administrator, has access to all sections of a library server while an administrator with limited privileges, a subadministrator, has access to only a section of the library server. Use of domains is transparent to users because they do not know that their access has been limited to only a part of the library server. Accordingly, users are aware only of items within that portion, or domain of the content management system to which those users are associated.
- FIG. 2 is a conceptual illustration of the relationship of various domains in a content management system. The entire content management system is managed by a super administrator who has total privileges for and access to the entire system. In that regard, the entire content management system can be considered a
super domain 26 corresponding to the universe of privileges and access controls. Thesuper domain 26, corresponding to the universal set and encompassing the entire content management system, is managed by the super administrator. The content management system can be partitioned intodomains Domain 2, Domain-n) and is managed by a subadministrator, also referred to as a domain administrator. Adefault domain 34 called Public, is a shared domain that is accessible by all administrators and users regardless of the domain to which they are assigned. Partitioning the content management system into domains enables domain administrators to administer only a portion of the content management system while preventing their access to other portions. - Each type of administrator has the ability to create, retrieve, update, and delete the objects in their domains, including users and collections. Domain administrators can view and retrieve objects only in their domain but also can list and retrieve objects in a public, or shared domain.
- Domain administrators cannot change the domain of an object. They can, however, access the contents of their own domain and list or retrieve any object in the public, or shared domain.
- Super administrators have access to all domains on the library server. They can create an object and assign it to a domain. Some objects, such as privilege sets and access control lists (ACL's), only may be created by a super administrator for a domain administrator to use.
- In order to enable domains within the content management system certain tables within the content management system are modified to include a domain ID column. These tables include the user table, the resource manager table, and collection name table. Also, an additional table referred to as the administration domain table is added to the system. It will be understood that other tables can be used or created in accordance with the invention, depending on the application.
- FIG. 3A shows an example of an administration domain table40. The table includes a
domain ID column 42 that holds identifiers of the various domains defined within the content management system. Adomain name column 44 provides a descriptive name of the domain. An ACLset codes column 46 and a privilege setcodes column 48 relate the ACL set codes and privilege set codes applicable for a domain with its domain ID. For example, in FIG. 3A domain D1 refers to the super domain. That domain is associated with the ACL set code of “AS1” and privilege set code “PS1.” Those set codes define sets of access control lists and sets of privileges that are associated with the super administrator. Subdomains such as domains D3 and D4 are domains established for separate organizations, such as different companies using the same content management system. In this example, “Company X” is assigned to domain D3. Company X's access is defined by access control lists associated with access control list set codes, AS27 and AS29. The privileges for Company X are defined by privilege set codes PS92 and PS93. Those access control list set codes and privilege set codes refer to ACL sets and privilege sets that define the access rights and the privileges that are granted to Company X. Accordingly, the domain D3 is limited by those access control lists and privileges. - The administration domain table40 also includes a public domain D2 that is a shared domain that is accessible by all users of the system. A default domain D1000 is used as the default domain when establishing a user. The system administrator, whether it be a super administrator or a domain administrator, can change the default domain to a domain with which the administrator is authorized to access.
- A user table in a
content management system 50 is shown in FIG. 3B and includes columns forUser ID 52, UserPrivilege Set Code 56, DefaultACL Set Code 58,Default Resource Manager 60, DefaultCollection Code 62,Password 64,User Name 66, and a column forOther Indicators 68. Adomain ID column 54 is added to the user table 50 to support the use of domains. - The
User ID column 52 specifies a unique user ID for each user of the content management system. ADomain ID 54 is associated with each user. The user also is associated with certain privileges defined by privilege set codes, and other information pertinent to the user such as a default ACL set for the user, the default resource manager to which objects stored by the user are placed, and a default collection code for the user's objects. The table also specifies a user name (i.e., X_Admin) and a password (i.e., ZYX). In FIG. 3B it can be seen that users X_JSmith and X_Admin are defined within the same domain D3, and user Y_Admin and Y_SJones are defined as being in domain D4. In this example, domain D3 is designated for Company X and domain D4 is designated for Company Y. - A resource manager is defined by a resource manager code plus other information that defines characteristics of the resource manager and the method of accessing that resource manager over a network, plus a domain ID to restrict visibility to the RM definition. A resource manager (RM) table70 is shown in FIG. 3C. This table relates information about resource managers with other information needed by the content management system. This table includes an
RM Code 72, an RM Name 74 (i.e., X_RM—1), aDomain ID 76, aNetwork Address 80 indicating an address on a network for the resource manager, andother indicators 80 with information needed by the system. ADomain ID 76 is added to the RM table 70 to associate the resource managers with domains. In the example shown in FIG. 3C, domain D3 is associated with two resource managers, namely resource manager X_RM—1 andX_RM —2. Domain D4 is associated with another resource manager,Y_RM —3. In this example, objects for Company X are stored in resource managers R1 and R2 and objects for Company Y are stored in resource manager R3. - Table3D illustrates a collection name table for using system-managed storage (SMS) collections in the content management system. This table includes an
SMS Collection Code 92, anSMS Collection Name 94, and anRM Code 96 where the collection resides. The table also includesOther Indicators 100 that may be used by the content management system. ADomain ID 98 is added to the collection name table to associate collections with domains. The collection name table associates a particular SMS collection with both a resource manager and a domain. For example, a collection “X-Collection-1,” which is resident on the resource manager having RM code R1, is associated with domain D3, and is given an SMS collection code of S1. Similarly, the domain D3 can include a second collection, in this case it is named “X-Collection—2,” having an SMS collection code of S2. - In operation, the domains are used to help a system administrator administer subsets of a content management system. Some of the administrative operations that can be performed as a result of using domains are described below.
- FIG. 4 is a flowchart illustrating a process of defining a domain. Referring to FIG. 4, a super administrator, who has the privileges suitable to define a domain within the content management system, initiates defining a new domain in
operation 102. Once the new domain is defined, the super administrator, inoperation 104, can associate a privilege set with the domain and can create or modify a definition of an ACL set to be associated with the new domain. The super administrator also specifies resource managers and collections for the domain inoperation 106. Inoperation 108 the super administrator assigns previously defined users of the content management system to the domain. Inoperation 110 the system administrator can also add a new user. If a new user is to be added, the super administrator specifies a privilege set authorized for the domain for that new user inoperation 112, and the process ends in operation 1114. If no new user is to be added afteroperation 108 the process ends inoperation 114. - When a domain administrator creates a user ID, the administrator has the choice of assigning it to a domain, or letting it remain with a default domain (e.g., Domain D1000) automatically designated at the time the user ID is created. A domain administrator can change the domain associated with the user ID at a later time by changing the user properties specified in the user table. A user ID can have access to only one domain at a time and would not be added to the public, or shared domain.
- Only super administrators have the authority to create domains and assign users to those domains as illustrated by the process in FIG. 4. However, once a domain is created, a domain administrator is designated for the domain. That domain administrator can define a new user in the content management system and that new user is restricted to acting only in the domain administrator's domain or in any domain designated as a public domain. While a domain can have more than one domain administrator, only the super administrator can define who those administrators are by granting them the appropriate system administration privileges within a privilege set for that domain.
- A process typically performed by a domain administrator is to add a new user to the domain administered by the domain administrator or to a public domain. FIG. 5 is a flowchart illustrating such a process. Referring to FIG. 5, a domain administrator, in
operation 120, such as a domain administrator for Company X, can add a new user to the domain for Company X, i.e., domain D3, or to a public domain. The new user is added without affecting other domains in the content management system, since the new user automatically is associated with the domain administrator's domain or to the public domain designated by the domain administrator. By using domains in the content management system this new user can be added by the domain administrator for Company X without involvement by the super administrator responsible for administering the entire content management system. - Any user ID added to a domain must also have an associated privilege set. The privilege sets can be placed in the public, or shared, domain to make them available to any user. In
operation 122 the Company X domain administrator specifies a privilege set for the new user. Here, the content management system, inoperation 124, determines whether the domain associated with the specified privilege set is equal to the domain administrator's domain or a public domain. If not, the system prevents those privileges from being associated with the user and the user definition fails inoperation 126. If the privilege set is associated with the appropriate domain, thenoperation 128 is performed in which the domain administrator specifies a default resource manager for the user. - User access can be restricted to one or more resource managers by assigning the user to a specific domain associated with those resource managers. When a new resource manager is defined for a library server to access, it can be associated with a domain, such that users who also are associated with that domain can use that resource manager. The default for all resource managers is public. If all users are not to have access to the resource manager, it must be assigned to a domain. In
operation 130 the system checks whether the domain associated with the specified resource manager equals the domain administrator's domain or is in a public domain. If not, the user definition fails 126, but if the domains are equal or if the resource manager is defined in a public domain, operation continues. - User access can be restricted to one or more collections on a resource manager by assigning those collections to a specific domain. Even if the resource manager for the collection is in the public domain, that collection still can be assigned to some other non-shared domain. If the resource manager, however, is defined to a specific domain already, then the collection cannot be assigned to any domain other than the one to which the resource manager is associated. In
operation 132 the Company X domain administrator specifies a default collection for the user. Inoperation 134 it is determined if the domain associated with the specified collection is the same as the domain administrator's domain or is a public domain. If not, then the user definition failure occurs as indicated inoperation 126. Otherwise, the user definition ends inoperation 136, and the new user is defined for the Company X domain. - Other tasks typically performed by an administrator can be performed by a domain administrator within the appropriate domain. For example, referring to FIG. 6, an administrator can request a list of all users, in
operation 150. This function can either list all registered users, regardless of whether they are logged onto the system, or list only the users who are logged on. In either case, the users can be listed by domain. Alternatively, the administrator, inoperation 150, can query the content management system for one or more specific users. In generating either the list or performing the query, the system, inoperation 152, checks whether the administrator making the request is a super administrator. If so, then inoperation 154 all of the users that are defined to the content management system are listed for the super administrator's use in performing an administrative task. If only the logged on users are requested, then only those users logged on are listed. Alternatively, if the request is to query a particular user or set of users, then inoperation 154 the system returns the user IDs for all users logged on to the content management system that satisfied the query. The process then ends atoperation 158. - If, in
operation 152, the administrator is not a super administrator, then inoperation 156 the, content management system lists only the users defined to the system and/or logged on to the system, who are members of the same domain as the administrator making the request. In this manner, a domain administrator can view only users within the administrator's domain. Accordingly, an administrator for Company X can only view the Company X users of the content management system. By using domains in the content management system the domain administrator for Company X does not have visibility into the users of any other domain such as Company Y's domain, even though Company Y's content is hosted on the same content management system. - Another administrative task that can be performed is updating user information. This is illustrated in FIG. 7. In
operation 170 an administrator requests an update to user information in the content management system. In operation 172 a determination is made whether the user's domain is the same as the requesting domain administrator's domain. If so, the update is allowed inoperation 174. However, if the domains are not equal, the process flows tooperation 176 where it is determined whether the administrator is a super administrator. If so, the update operation is allowed inoperation 174. However, if the administrator is not a super administrator, then the request is refused inoperation 178. In this way a user in one domain cannot update the user information of the user in another domain. - For example, the Company X domain administrator cannot change user information for a user who is a member of the Company Y domain, even though Company Y and Company X share the same content management system. Accordingly, various organizations' information hosted on the same content manager server are separated and kept private.
- Still other tasks can be performed by a super administrator. For example, a super administrator can create a user group by grouping together multiple user IDs into a logical group. A group is associated with a domain either a private domain or a public domain. A domain administrator can view users only if the group's domain ID matches the domain administrator's domain ID or is an ID for a public domain. Similarly, a domain administrator can add a user to a group only if the user's domain ID matches the group's domain ID or corresponds to a public domain. A domain administrator can query a group having the same domain ID as the domain administrator, or a group designated as a public group. The system can be configured so that only the users with a domain ID matching the domain administrator's domain ID or are associated with a public domain are listed in response to the query.
- It will be appreciated that using domains in a content management system can facilitate other administrative tasks that can be performed by a domain administrator.
- Having described apparatuses, articles of manufacture and methods of delegating administrative operations in user enrollment tasks in a content management system, it is believed that other modifications, variations and changes will be suggested to those skilled in the art in view of the teachings set forth herein. It is therefore to be understood that all such variations, modifications and changes are believed to fall within the scope of the present invention as defined by the appended claims. Although specific terms are employed herein, they are used in their ordinary and accustomed manner only, unless expressly defined differently herein, and not for purposes of limitation.
Claims (24)
1. A method of controlling administrative operations in a data store, comprising:
defining a domain among a plurality of domains for the data store;
designating a domain administrator for the domain; and
enabling the domain administrator to perform administrative operations within the domain without enabling the domain administrator to access information in at least one other of the plurality of domains.
2. The method of claim 1 , wherein the data store is a content management system storing multimedia content.
3. The method of claim 2 , wherein at least one of the administrative operations the domain administrator is enabled to perform is to associate a user with said domain among the plurality of domains, thereby preventing the user's access to information in at least one other of said plurality of domains of the content management system.
4. The method of claim 2 , wherein content management system includes an administration domain table that associates the domain with a set of privileges.
5. The method of claim 4 , wherein the administration domain table associates the domain with an access control list.
6. The method of claim 5 , wherein the content management system includes a user table having a row containing a user identifier, and a user is identified by adding an identifier for the domain in said row.
7. A method of limiting an administrator's actions in a content management system, wherein the administrator is associated with an administrative domain defined for the content management system, the method comprising:
determining, in response to receiving a request by the administrator to take an action with respect to resources defined in the content management system, the domain associated with the administrator; and
limiting the requested action to said resources that are associated with a domain that matches the domain associated with the administrator.
8. The method of claim 7 , wherein the requested action is a listing of users' identifiers of the content management system, and said limiting the requested action lists only the users' identifiers associated with the domain associated with the administrator or a public domain.
9. The method of claim 7 , wherein the requested action is a listing of resource managers defined in the content management system for storing content objects and said limiting the request lists only the resource managers associated with the domain associated with the administrator or a public domain.
10. The method of claim 7 , wherein the requested action is a listing of collections of objects defined in the content management system and stored in a resource manager, and said limiting the request lists only the collections associated with the domain associated with the administrator or a public domain.
11. The method of claim 7 , further comprising defining a user in the content management system and associating with the user the domain associated with the administrator.
12. The method of claim 11 , wherein the content management system includes a user table having a row containing an identifier for the user, and the user is associated with the domain by adding an identifier of the domain to said row containing the user identifier.
13. The method of claim 7 , further comprising defining a resource manager in the content management system and associating with the resource manager the domain associated with the administrator.
14. The method of claim 7 , further comprising defining a collection of objects stored in a resource manager in the content management system and associating with the collection the domain associated with the administrator.
15. The method of claim 7 , further comprising defining a super administrator by associating a predetermined domain identifier designated to allow access to all domains defined in the content management system, wherein if said administrator is a super administrator, said limiting the requested action is not performed.
16. A program product embodied on a computer readable medium for limiting an administrator's actions in a content management system, wherein the administrator is associated with an administrative domain defined for the content management system, the computer readable medium comprising:
program instructions for determining, in response to receiving a request by the administrator to take an action with respect to resources defined in the content management system, the domain associated with the administrator; and
program instructions for limiting the requested action to said resources that are associated with a domain that matches the domain associated with the administrator.
17. The program product of claim 16 , wherein the requested action is a listing of users' identifiers of the content management system, and said limiting the requested action lists only the users' identifiers associated with the domain associated with the administrator or a public domain.
18. The program product of claim 16 , wherein the requested action is a listing of resource managers defined in the content management system for storing content objects and said limiting the request lists only the resource managers associated with the domain associated with the administrator or a public domain.
19. The program product of claim 16 , wherein the requested action is a listing of collections of objects defined in the content management system and stored in a resource manager, and said limiting the request lists only the collections associated with the domain associated with the administrator or a public domain.
20. The program product of claim 16 , further comprising program instructions for defining a user in the content management system and associating with the user the domain associated with the administrator.
21. The program product of claim 20 , wherein the content management system includes a user table having a row containing an identifier for the user, and the user is associated with the domain by adding an identifier of the domain to said row containing the user identifier.
22. The program product of claim 16 , further comprising program instructions for defining a resource manager in the content management system and associating with the resource manager the domain associated with the administrator.
23. The program product of claim 16 , further comprising program instructions for defining a collection of objects stored in a resource manager in the content management system and associating with the collection the domain associated with the administrator.
24. The program product of claim 16 , further comprising program instructions for defining a super administrator by associating a predetermined domain identifier designated to allow access to all domains defined in the content management system, wherein if said administrator is a super administrator, said limiting the requested action is not performed.
Priority Applications (1)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
US10/327,329 US7533157B2 (en) | 2002-12-24 | 2002-12-24 | Method for delegation of administrative operations in user enrollment tasks |
Applications Claiming Priority (1)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
US10/327,329 US7533157B2 (en) | 2002-12-24 | 2002-12-24 | Method for delegation of administrative operations in user enrollment tasks |
Publications (2)
Publication Number | Publication Date |
---|---|
US20040122946A1 true US20040122946A1 (en) | 2004-06-24 |
US7533157B2 US7533157B2 (en) | 2009-05-12 |
Family
ID=32594224
Family Applications (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
US10/327,329 Expired - Fee Related US7533157B2 (en) | 2002-12-24 | 2002-12-24 | Method for delegation of administrative operations in user enrollment tasks |
Country Status (1)
Country | Link |
---|---|
US (1) | US7533157B2 (en) |
Cited By (15)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US7181473B1 (en) * | 2002-11-12 | 2007-02-20 | Microsoft Corporation | Identifying files within a namespace |
US20070113287A1 (en) * | 2004-11-17 | 2007-05-17 | Steven Blumenau | Systems and Methods for Defining Digital Asset Tag Attributes |
US20070113288A1 (en) * | 2005-11-17 | 2007-05-17 | Steven Blumenau | Systems and Methods for Digital Asset Policy Reconciliation |
US20070113289A1 (en) * | 2004-11-17 | 2007-05-17 | Steven Blumenau | Systems and Methods for Cross-System Digital Asset Tag Propagation |
WO2007080533A1 (en) * | 2006-01-10 | 2007-07-19 | Nokia Corporation | Content access management |
US20090165124A1 (en) * | 2007-12-19 | 2009-06-25 | Microsoft Corporation | Reducing cross-site scripting attacks by segregating http resources by subdomain |
US20100185963A1 (en) * | 2009-01-19 | 2010-07-22 | Bycast Inc. | Modifying information lifecycle management rules in a distributed system |
US20100268824A1 (en) * | 2007-07-23 | 2010-10-21 | Novell, Inc. | System and method for cross-authoritative configuration management |
US20100306276A1 (en) * | 2009-05-26 | 2010-12-02 | Yahoo! Inc. | Dynamic group labels |
US8024794B1 (en) * | 2005-11-30 | 2011-09-20 | Amdocs Software Systems Limited | Dynamic role based authorization system and method |
US20120054309A1 (en) * | 2005-03-23 | 2012-03-01 | International Business Machines Corporation | Selecting a resource manager to satisfy a service request |
US8412754B2 (en) | 2010-04-21 | 2013-04-02 | International Business Machines Corporation | Virtual system administration environment for non-root user |
US20170048223A1 (en) * | 2015-08-15 | 2017-02-16 | Microsoft Technology Licensing, Llc | Domain joined virtual names on domainless servers |
WO2019132651A1 (en) * | 2017-12-28 | 2019-07-04 | Mimos Berhad | A system and method for managing role of administrators |
US10999282B2 (en) * | 2002-08-19 | 2021-05-04 | Blackberry Limited | System and method for secure control of resources of wireless mobile communication devices |
Families Citing this family (8)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
JP4293959B2 (en) * | 2004-09-16 | 2009-07-08 | シャープ株式会社 | Image processing apparatus, program, and recording medium |
JP4843499B2 (en) * | 2004-10-12 | 2011-12-21 | 富士通株式会社 | Control program, control method, and control apparatus |
WO2007073470A2 (en) | 2005-12-23 | 2007-06-28 | Perdiem, Llc | System and method for defining an event based on a relationship between an object location and a user-defined zone |
US7525425B2 (en) | 2006-01-20 | 2009-04-28 | Perdiem Llc | System and method for defining an event based on relationship between an object location and a user-defined zone |
US8392682B2 (en) * | 2008-12-17 | 2013-03-05 | Unisys Corporation | Storage security using cryptographic splitting |
US8863299B2 (en) | 2012-01-06 | 2014-10-14 | Mobile Iron, Inc. | Secure virtual file management system |
US9122887B2 (en) * | 2012-01-06 | 2015-09-01 | Mobile Iron, Inc. | User interface for secure virtual document management system |
US20140181303A1 (en) * | 2012-12-21 | 2014-06-26 | Scott Andrew Meyer | Custom local content provision |
Citations (36)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US5335346A (en) * | 1989-05-15 | 1994-08-02 | International Business Machines Corporation | Access control policies for an object oriented database, including access control lists which span across object boundaries |
US5649185A (en) * | 1991-03-01 | 1997-07-15 | International Business Machines Corporation | Method and means for providing access to a library of digitized documents and images |
US5715461A (en) * | 1994-05-16 | 1998-02-03 | Fujitsu Limited | System for managing software development in distributed development environment |
US5784612A (en) * | 1995-05-03 | 1998-07-21 | International Business Machines Corporation | Configuration and unconfiguration of distributed computing environment components |
US5802291A (en) * | 1995-03-30 | 1998-09-01 | Sun Microsystems, Inc. | System and method to control and administer distributed object servers using first class distributed objects |
US5857203A (en) * | 1996-07-29 | 1999-01-05 | International Business Machines Corporation | Method and apparatus for dividing, mapping and storing large digital objects in a client/server library system |
US5867665A (en) * | 1997-03-24 | 1999-02-02 | Pfn, Inc | Domain communications server |
US5867667A (en) * | 1997-03-24 | 1999-02-02 | Pfn, Inc. | Publication network control system using domain and client side communications resource locator lists for managing information communications between the domain server and publication servers |
US5870562A (en) * | 1997-03-24 | 1999-02-09 | Pfn, Inc. | Universal domain routing and publication control system |
US5884035A (en) * | 1997-03-24 | 1999-03-16 | Pfn, Inc. | Dynamic distributed group registry apparatus and method for collaboration and selective sharing of information |
US5911143A (en) * | 1994-08-15 | 1999-06-08 | International Business Machines Corporation | Method and system for advanced role-based access control in distributed and centralized computer systems |
US5941947A (en) * | 1995-08-18 | 1999-08-24 | Microsoft Corporation | System and method for controlling access to data entities in a computer network |
US5999978A (en) * | 1997-10-31 | 1999-12-07 | Sun Microsystems, Inc. | Distributed system and method for controlling access to network resources and event notifications |
US6021410A (en) * | 1997-09-25 | 2000-02-01 | International Business Machines Corporation | Extensible digital library |
US6026430A (en) * | 1997-03-24 | 2000-02-15 | Butman; Ronald A. | Dynamic client registry apparatus and method |
US6044373A (en) * | 1997-09-29 | 2000-03-28 | International Business Machines Corporation | Object-oriented access control method and system for military and commercial file systems |
US6044378A (en) * | 1997-09-29 | 2000-03-28 | International Business Machines Corporation | Method and system for a federated digital library by managing links |
US6055637A (en) * | 1996-09-27 | 2000-04-25 | Electronic Data Systems Corporation | System and method for accessing enterprise-wide resources by presenting to the resource a temporary credential |
US6088679A (en) * | 1997-12-01 | 2000-07-11 | The United States Of America As Represented By The Secretary Of Commerce | Workflow management employing role-based access control |
US6105027A (en) * | 1997-03-10 | 2000-08-15 | Internet Dynamics, Inc. | Techniques for eliminating redundant access checking by access filters |
US6148323A (en) * | 1995-12-29 | 2000-11-14 | Hewlett-Packard Company | System and method for managing the execution of system management |
US6161139A (en) * | 1998-07-10 | 2000-12-12 | Encommerce, Inc. | Administrative roles that govern access to administrative functions |
US6178505B1 (en) * | 1997-03-10 | 2001-01-23 | Internet Dynamics, Inc. | Secure delivery of information in a network |
US6308163B1 (en) * | 1999-03-16 | 2001-10-23 | Hewlett-Packard Company | System and method for enterprise workflow resource management |
US6560609B1 (en) * | 1999-06-14 | 2003-05-06 | International Business Machines Corporation | Delegating instance management functions to underlying resource managers |
US6567818B1 (en) * | 1999-06-14 | 2003-05-20 | International Business Machines Corporation | Employing management policies to manage instances of objects |
US20030135611A1 (en) * | 2002-01-14 | 2003-07-17 | Dean Kemp | Self-monitoring service system with improved user administration and user access control |
US20030187956A1 (en) * | 2002-04-01 | 2003-10-02 | Stephen Belt | Method and apparatus for providing access control and content management services |
US6671695B2 (en) * | 2001-06-18 | 2003-12-30 | The Procter & Gamble Company | Dynamic group generation and management |
US20040122849A1 (en) * | 2002-12-24 | 2004-06-24 | International Business Machines Corporation | Assignment of documents to a user domain |
US20040122871A1 (en) * | 2002-12-24 | 2004-06-24 | International Business Machines Corporation | Fail over resource manager access in a content management system |
US6772157B2 (en) * | 2000-10-19 | 2004-08-03 | General Electric Company | Delegated administration of information in a database directory |
US6976023B2 (en) * | 2002-04-23 | 2005-12-13 | International Business Machines Corporation | System and method for managing application specific privileges in a content management system |
US7076541B1 (en) * | 2000-06-05 | 2006-07-11 | Register.Com, Inc. | Method and apparatus providing distributed domain management capabilities |
US7200869B1 (en) * | 2000-09-15 | 2007-04-03 | Microsoft Corporation | System and method for protecting domain data against unauthorized modification |
US7398311B2 (en) * | 2000-07-10 | 2008-07-08 | Oracle International Corporation | Selective cache flushing in identity and access management systems |
-
2002
- 2002-12-24 US US10/327,329 patent/US7533157B2/en not_active Expired - Fee Related
Patent Citations (36)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US5335346A (en) * | 1989-05-15 | 1994-08-02 | International Business Machines Corporation | Access control policies for an object oriented database, including access control lists which span across object boundaries |
US5649185A (en) * | 1991-03-01 | 1997-07-15 | International Business Machines Corporation | Method and means for providing access to a library of digitized documents and images |
US5715461A (en) * | 1994-05-16 | 1998-02-03 | Fujitsu Limited | System for managing software development in distributed development environment |
US5911143A (en) * | 1994-08-15 | 1999-06-08 | International Business Machines Corporation | Method and system for advanced role-based access control in distributed and centralized computer systems |
US5802291A (en) * | 1995-03-30 | 1998-09-01 | Sun Microsystems, Inc. | System and method to control and administer distributed object servers using first class distributed objects |
US5784612A (en) * | 1995-05-03 | 1998-07-21 | International Business Machines Corporation | Configuration and unconfiguration of distributed computing environment components |
US5941947A (en) * | 1995-08-18 | 1999-08-24 | Microsoft Corporation | System and method for controlling access to data entities in a computer network |
US6148323A (en) * | 1995-12-29 | 2000-11-14 | Hewlett-Packard Company | System and method for managing the execution of system management |
US5857203A (en) * | 1996-07-29 | 1999-01-05 | International Business Machines Corporation | Method and apparatus for dividing, mapping and storing large digital objects in a client/server library system |
US6055637A (en) * | 1996-09-27 | 2000-04-25 | Electronic Data Systems Corporation | System and method for accessing enterprise-wide resources by presenting to the resource a temporary credential |
US6105027A (en) * | 1997-03-10 | 2000-08-15 | Internet Dynamics, Inc. | Techniques for eliminating redundant access checking by access filters |
US6178505B1 (en) * | 1997-03-10 | 2001-01-23 | Internet Dynamics, Inc. | Secure delivery of information in a network |
US5884035A (en) * | 1997-03-24 | 1999-03-16 | Pfn, Inc. | Dynamic distributed group registry apparatus and method for collaboration and selective sharing of information |
US5870562A (en) * | 1997-03-24 | 1999-02-09 | Pfn, Inc. | Universal domain routing and publication control system |
US5867667A (en) * | 1997-03-24 | 1999-02-02 | Pfn, Inc. | Publication network control system using domain and client side communications resource locator lists for managing information communications between the domain server and publication servers |
US6026430A (en) * | 1997-03-24 | 2000-02-15 | Butman; Ronald A. | Dynamic client registry apparatus and method |
US5867665A (en) * | 1997-03-24 | 1999-02-02 | Pfn, Inc | Domain communications server |
US6021410A (en) * | 1997-09-25 | 2000-02-01 | International Business Machines Corporation | Extensible digital library |
US6044373A (en) * | 1997-09-29 | 2000-03-28 | International Business Machines Corporation | Object-oriented access control method and system for military and commercial file systems |
US6044378A (en) * | 1997-09-29 | 2000-03-28 | International Business Machines Corporation | Method and system for a federated digital library by managing links |
US5999978A (en) * | 1997-10-31 | 1999-12-07 | Sun Microsystems, Inc. | Distributed system and method for controlling access to network resources and event notifications |
US6088679A (en) * | 1997-12-01 | 2000-07-11 | The United States Of America As Represented By The Secretary Of Commerce | Workflow management employing role-based access control |
US6161139A (en) * | 1998-07-10 | 2000-12-12 | Encommerce, Inc. | Administrative roles that govern access to administrative functions |
US6308163B1 (en) * | 1999-03-16 | 2001-10-23 | Hewlett-Packard Company | System and method for enterprise workflow resource management |
US6560609B1 (en) * | 1999-06-14 | 2003-05-06 | International Business Machines Corporation | Delegating instance management functions to underlying resource managers |
US6567818B1 (en) * | 1999-06-14 | 2003-05-20 | International Business Machines Corporation | Employing management policies to manage instances of objects |
US7076541B1 (en) * | 2000-06-05 | 2006-07-11 | Register.Com, Inc. | Method and apparatus providing distributed domain management capabilities |
US7398311B2 (en) * | 2000-07-10 | 2008-07-08 | Oracle International Corporation | Selective cache flushing in identity and access management systems |
US7200869B1 (en) * | 2000-09-15 | 2007-04-03 | Microsoft Corporation | System and method for protecting domain data against unauthorized modification |
US6772157B2 (en) * | 2000-10-19 | 2004-08-03 | General Electric Company | Delegated administration of information in a database directory |
US6671695B2 (en) * | 2001-06-18 | 2003-12-30 | The Procter & Gamble Company | Dynamic group generation and management |
US20030135611A1 (en) * | 2002-01-14 | 2003-07-17 | Dean Kemp | Self-monitoring service system with improved user administration and user access control |
US20030187956A1 (en) * | 2002-04-01 | 2003-10-02 | Stephen Belt | Method and apparatus for providing access control and content management services |
US6976023B2 (en) * | 2002-04-23 | 2005-12-13 | International Business Machines Corporation | System and method for managing application specific privileges in a content management system |
US20040122871A1 (en) * | 2002-12-24 | 2004-06-24 | International Business Machines Corporation | Fail over resource manager access in a content management system |
US20040122849A1 (en) * | 2002-12-24 | 2004-06-24 | International Business Machines Corporation | Assignment of documents to a user domain |
Cited By (25)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US10999282B2 (en) * | 2002-08-19 | 2021-05-04 | Blackberry Limited | System and method for secure control of resources of wireless mobile communication devices |
US7181473B1 (en) * | 2002-11-12 | 2007-02-20 | Microsoft Corporation | Identifying files within a namespace |
US20070113289A1 (en) * | 2004-11-17 | 2007-05-17 | Steven Blumenau | Systems and Methods for Cross-System Digital Asset Tag Propagation |
US20070113287A1 (en) * | 2004-11-17 | 2007-05-17 | Steven Blumenau | Systems and Methods for Defining Digital Asset Tag Attributes |
US7958087B2 (en) * | 2004-11-17 | 2011-06-07 | Iron Mountain Incorporated | Systems and methods for cross-system digital asset tag propagation |
US8037036B2 (en) | 2004-11-17 | 2011-10-11 | Steven Blumenau | Systems and methods for defining digital asset tag attributes |
US20120054309A1 (en) * | 2005-03-23 | 2012-03-01 | International Business Machines Corporation | Selecting a resource manager to satisfy a service request |
US10977088B2 (en) * | 2005-03-23 | 2021-04-13 | International Business Machines Corporation | Selecting a resource manager to satisfy a service request |
US20070113288A1 (en) * | 2005-11-17 | 2007-05-17 | Steven Blumenau | Systems and Methods for Digital Asset Policy Reconciliation |
US8024794B1 (en) * | 2005-11-30 | 2011-09-20 | Amdocs Software Systems Limited | Dynamic role based authorization system and method |
WO2007080533A1 (en) * | 2006-01-10 | 2007-07-19 | Nokia Corporation | Content access management |
US20100268824A1 (en) * | 2007-07-23 | 2010-10-21 | Novell, Inc. | System and method for cross-authoritative configuration management |
US9172707B2 (en) * | 2007-12-19 | 2015-10-27 | Microsoft Technology Licensing, Llc | Reducing cross-site scripting attacks by segregating HTTP resources by subdomain |
US20090165124A1 (en) * | 2007-12-19 | 2009-06-25 | Microsoft Corporation | Reducing cross-site scripting attacks by segregating http resources by subdomain |
US20100185963A1 (en) * | 2009-01-19 | 2010-07-22 | Bycast Inc. | Modifying information lifecycle management rules in a distributed system |
US8898267B2 (en) * | 2009-01-19 | 2014-11-25 | Netapp, Inc. | Modifying information lifecycle management rules in a distributed system |
US9542415B2 (en) | 2009-01-19 | 2017-01-10 | Netapp, Inc. | Modifying information lifecycle management rules in a distributed system |
US20100306276A1 (en) * | 2009-05-26 | 2010-12-02 | Yahoo! Inc. | Dynamic group labels |
US8412754B2 (en) | 2010-04-21 | 2013-04-02 | International Business Machines Corporation | Virtual system administration environment for non-root user |
US20170048223A1 (en) * | 2015-08-15 | 2017-02-16 | Microsoft Technology Licensing, Llc | Domain joined virtual names on domainless servers |
US9813413B2 (en) * | 2015-08-15 | 2017-11-07 | Microsoft Technology Licensing, Llc | Domain joined virtual names on domainless servers |
CN107925659A (en) * | 2015-08-15 | 2018-04-17 | 微软技术许可有限责任公司 | Domain on no domain server adds virtual name |
US10270760B2 (en) | 2015-08-15 | 2019-04-23 | Microsoft Tehnology Licensing, LLC | Domain joined virtual names on domainless servers |
US10798092B2 (en) | 2015-08-15 | 2020-10-06 | Microsoft Technology Licensing, Llc | Domain joined virtual names on domainless servers |
WO2019132651A1 (en) * | 2017-12-28 | 2019-07-04 | Mimos Berhad | A system and method for managing role of administrators |
Also Published As
Publication number | Publication date |
---|---|
US7533157B2 (en) | 2009-05-12 |
Similar Documents
Publication | Publication Date | Title |
---|---|---|
US7533157B2 (en) | Method for delegation of administrative operations in user enrollment tasks | |
US20040122849A1 (en) | Assignment of documents to a user domain | |
US9870483B2 (en) | Row-level security in a relational database management system | |
EP2143051B1 (en) | In-memory caching of shared customizable multi-tenant data | |
US7480677B2 (en) | System and program for maintaining a namespace of filesets accessible to clients over a network | |
US6081898A (en) | Unification of directory service with file system service | |
US7233959B2 (en) | Life-cycle management engine | |
US5987471A (en) | Sub-foldering system in a directory-service-based launcher | |
US20070294290A1 (en) | Fail over resource manager access in a content management system | |
US7475199B1 (en) | Scalable network file system | |
US20020095432A1 (en) | Document management system | |
US7599959B2 (en) | Centralized access and management for multiple, disparate data repositories | |
US20080215588A1 (en) | Electronic object sharing system | |
US7363328B2 (en) | Method and system for modifying schema definitions | |
US20070124467A1 (en) | Method and apparatus for managing publication and sharing of data | |
US20040064419A1 (en) | Distributed management and administration of licensing of multi-function offering applications | |
EP1490794A2 (en) | Life-cycle management engine |
Legal Events
Date | Code | Title | Description |
---|---|---|---|
AS | Assignment |
Owner name: INTERNATIONAL BUSINESS MACHINES CORPORATION, NEW Y Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNORS:HU, TAWEI;NELSON, KENNETH CARLIN;TAO, TRACEE;AND OTHERS;REEL/FRAME:013635/0576;SIGNING DATES FROM 20021216 TO 20021219 |
|
FEPP | Fee payment procedure |
Free format text: PAYOR NUMBER ASSIGNED (ORIGINAL EVENT CODE: ASPN); ENTITY STATUS OF PATENT OWNER: LARGE ENTITY |
|
REMI | Maintenance fee reminder mailed | ||
FPAY | Fee payment |
Year of fee payment: 4 |
|
SULP | Surcharge for late payment | ||
REMI | Maintenance fee reminder mailed | ||
LAPS | Lapse for failure to pay maintenance fees | ||
STCH | Information on status: patent discontinuation |
Free format text: PATENT EXPIRED DUE TO NONPAYMENT OF MAINTENANCE FEES UNDER 37 CFR 1.362 |
|
FP | Lapsed due to failure to pay maintenance fee |
Effective date: 20170512 |